[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CACYkhxi4j2ROWgxPn6CerouZFRzvP1=R4TV9AiHjeqMTWEaTnw@mail.gmail.com>
Date: Wed, 4 Mar 2015 10:42:08 +1100
From: Michael Samuel <mik@...net.net>
To: oss-security@...ts.openwall.com
Subject: PostgreSQL password hashing
Hi all,
I'm posting this to the list, since it seems to be making the rounds finally :)
The "pass the hash" flaw and weak password hashing scheme in
PostgreSQL was known to be weak at the time it was implemented. I was
among a chorus of people who spoke out about it at the time of it's
inclusion, but the developers' response boiled down to:
http://marc.info/?l=postgresql-general&m=111414028609961&w=2
This was recently rediscovered by atom from hashcat:
http://hashcat.net/forum/thread-4148.html
To protect yourself:
1) Put "password" instead of "md5" in pg_hba.conf
2) Use a randomly generated, unique password rather than an actual word.
3) Don't let attackers see your pg_shadow
The reason for (1) is that the password auth protocol doesn't accept
hashes. Use TLS if network attacks are a problem.
The reason for (2) - which is a good idea anyway - is because the hash
in the database is is just md5(password username). If the username is
"wordpress" for example, you could crack multiple hashes for similar
cost to cracking one.
(3) is a bit tongue-in-cheek, but pg_shadow is only accessible to
superusers, so don't connect your webapp as a database superuser and
you significantly reduce the risk of lots of bad stuff :)
Regards,
Michael
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
